How To Separate Radio Site Monitoring From The IT Network Without Losing Alarms

Monitoring network isolation is the practice of keeping the network that connects remote site equipment - RTUs, radios, power plants, and sensors - physically or logically separate from the organization's business IT network. A dual-homed alarm master sits at the boundary, with one network interface on the isolated equipment network and another on the IT network, so alarms and email can reach people without opening a path between the two networks.

This article explains why public safety and utility teams isolate their monitoring networks, how a central alarm master with multiple network interfaces makes that practical, and how the same system can consolidate site alarms and analog readings like generator fuel levels into one view. It is written for radio systems technicians, communications managers, and IT staff at counties, emergency communications agencies, and utilities.

Why Isolate A Radio Or Utility Monitoring Network From IT?

Remote site equipment was rarely designed with the internet in mind. Many RTUs, power plants, and radio infrastructure devices assume they live on a trusted, private network. When that assumption breaks, the exposure can be significant.

The most common way it breaks is accidental. A single connection between the equipment network and a network with internet access - a misconfigured switch port, a convenient patch cable, or a router added for a short-term project - can expose dozens of devices at once. Teams that have lived through this kind of incident tend to make isolation a priority afterward.

Isolation reduces the risk in several ways:

• Limits who can reach field devices. Only systems on the equipment network can talk to RTUs and radios directly.
• Contains mistakes. A problem on the IT network does not automatically become a problem at every radio site.
• Simplifies security reviews. A clearly defined boundary is easier to document and audit than a flat network.
• Protects critical communications. For public safety radio, the monitoring network supports systems that dispatch depends on.

How Does A Dual-NIC Alarm Master Bridge Two Networks Safely?

An alarm master is the central system that collects alarms from field RTUs and other devices, stores history, and notifies people. When it has two or more network interface cards (NICs), each interface can sit on a different network.

A typical isolated design looks like this:

The point is that the alarm master is the only system with a foot in both networks, and it does not route traffic between them. RTUs never need a path to the internet to send an email; they report to the alarm master, and the alarm master sends the email from its IT-side interface. DPS T/Mon alarm masters support multiple network interfaces for exactly this kind of separation.

Coordinate the design with IT early. Decide which services the IT-side interface needs - usually mail relay and a time source - and restrict it to those. Firewall rules on the IT side should allow the alarm master to send mail and receive user web sessions, and little else. DPS outlines more on secure monitoring design.

Why Keep Independent Site Alarming Alongside A Radio Vendor's Manager?

Modern trunked radio systems often come with their own element manager that collects alarms from radio equipment. It is natural to ask whether a separate site monitoring system is still needed.

Many agencies keep both, and intentionally duplicate some alarms between them, for good reasons:

• Different scope. The radio manager focuses on radio equipment. Site infrastructure - doors, generators, commercial power, battery discharge, HVAC, and fuel - usually comes from RTUs.
• After-hours notification. Radio element managers are often built around a staffed console. Site RTUs and alarm masters typically send email and text notifications directly, so a technician gets a message at 2 a.m. even when no one is watching a screen.
• Situational awareness for dispatch calls. When dispatch calls overnight about a site problem, a technician who already has the alarm on a phone can start with the right question.
• Independence. If one system has an issue, the other still reports.

An existing fleet of site RTUs, such as units in the NetGuardian family, can keep emailing alarms during the transition and then report to the central alarm master once it is in place.

How Do You Size A Central Alarm Master For About 20 Sites?

Sizing an alarm master starts with device count and growth plans, not with the largest platform available. A county or agency with around 20 RTUs and a goal of centralizing existing alarms usually does not need a large-network system.

A practical approach:

1. Count current devices. Include every RTU and any other device that will report directly, such as power plants or battery systems with SNMP.
2. Estimate growth. New sites, new generators, and new battery plants add devices over time.
3. List required features. Separate network interfaces, email notifications, analog grouping, and scheduled reports are common must-haves.
4. Pick the smallest platform that fits with room to grow. The T/Mon MINI is designed for small networks, with larger T/Mon platforms available if requirements expand.

Starting smaller is not a dead end. Data and configuration can move to a larger platform later if the network grows past what the smaller system was sized for.

How Can One Screen Show Fuel Levels Across Every Generator Site?

As generator fleets grow, simple dry-contact low-fuel alarms stop being enough. A team with two generators can live with "fuel low" alarms. A team with fifteen needs to know how much fuel is in every tank so deliveries can be planned.

The usual progression:

• Add analog fuel level sensing at each generator, with the RTU scaling the reading to percent full. DPS covers sensor options and wiring for D-Wire sensors and analog inputs.
• Group the readings centrally. An alarm master can collect every fuel reading into one analog group, displayed as a grid or set of gauges.
• Schedule a report. A weekly report of fuel levels at every site, emailed automatically, means the person responsible for generators does not have to log in to check.

That last point matters for adoption. The facilities employee who manages generators is often not a radio technician and does not want to log into several systems. A single consolidated screen and a scheduled email meet that person where they are.

Derived Alarms help as well. Low fuel by itself may be a routine refill item, and commercial power failure by itself may be expected at a site with backup. Both at once is critical, and an alarm master or RTU can create a single high-priority alarm for that combination.

How Do Off-Grid Sites Fit Into The Same Monitoring System?

Off-grid radio sites powered by solar, batteries, and generators add new equipment to monitor: solar charge controllers, battery management systems, and rectifiers. These systems often expose data through SNMP or Modbus rather than contact closures.

Planning tips for off-grid sites:

• Ask what each power component exposes. Modern lithium battery systems and solar controllers frequently support Modbus or SNMP.
• Use the RTU as the local collector. Current-generation RTUs can poll Modbus devices and convert that data into alarms and analog values.
• Add protocols when needed. Protocol options can often be added later, so a site can start with contact closures and add Modbus polling once requirements are clear.
• Watch battery state closely. At off-grid sites, battery state of charge is the equivalent of a fuel gauge. See battery monitoring best practices.

Homegrown collectors built on small single-board computers are sometimes used to gather battery data. They can work, but a supported RTU that polls the battery system directly is easier to maintain across many sites.

FAQ: Isolating A Monitoring Network With A Central Alarm Master

Why separate the monitoring network from the IT network?

To limit who can reach field equipment, contain mistakes such as an accidental internet connection, and simplify security reviews. Site equipment often assumes it is on a trusted private network.

How can alarms reach email if the RTUs are isolated?

The RTUs report to a central alarm master on the isolated network. The alarm master uses a second network interface on the IT network to send email and get network time, without routing traffic between the two networks.

Do we still need site RTUs if our radio system has its own alarm manager?

Usually yes. Radio managers focus on radio equipment, while RTUs cover site infrastructure such as doors, power, generators, batteries, and fuel. RTUs and alarm masters also send after-hours notifications directly.

What size alarm master fits about 20 RTUs?

A small-network platform such as the T/Mon MINI is typically a good starting point for around 20 devices, with larger platforms available if the network grows.

Can we see fuel levels for every generator in one place?

Yes. Analog fuel readings from each site can be grouped into one view on the alarm master and sent out as a scheduled email report.

Can off-grid battery and solar systems be monitored?

Often yes, through SNMP or Modbus if the equipment supports it. An RTU at the site can poll those systems and report their data with the rest of the site alarms.

Get A Free Consultation

If your radio or utility monitoring network shares a path with IT, or your site alarms are spread across systems that only some people can see, a dual-homed alarm master can isolate the equipment and consolidate the alarms. DPS Telecom has helped public safety agencies and utilities monitor remote sites since 1986. Get a Free Consultation, or call 1-800-693-0351 or email sales@dpstele.com.

Andrew Erickson

Andrew Erickson is an Application Engineer at DPS Telecom, a manufacturer of semi-custom remote alarm monitoring systems based in Fresno, California. Andrew brings more than 19 years of experience building site monitoring solutions, developing intuitive user interfaces and documentation, and opt...